CVE-2026-58458: Don't Starve Together Memory Corruption via world_gen_data
Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string decoder that allows a remote attacker operating a public dedicated server to crash a victim's game client by publishing crafted worldgendata with an invalid Klei persistent blob header length. Attackers can craft a malicious public lobby server listing that, once viewed or selected by the victim, triggers client-side decoding of the attacker-controlled data to corrupt native memory and cause a remote denial of service.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Players using affected Don't Starve Together clients are exposed when they view or select a crafted public dedicated-server lobby listing. The attacker must operate a public dedicated server and publish malicious world_gen_data.
Does exploitation require the victim to join the malicious server?
No. The crafted data can be decoded when the victim views or selects the malicious public lobby server listing; joining is not stated as necessary.
What is the practical impact of successful exploitation?
Successful exploitation corrupts native client memory and crashes the victim's game client, resulting in a remote denial of service. The provided data does not describe confidentiality or integrity impact.
How can an affected player reduce exposure before an update is available?
Avoid viewing or selecting untrusted public dedicated-server listings, since those actions can trigger decoding of attacker-controlled world_gen_data. The provided information does not identify a client-side configuration workaround.